DECCS SAS (“CineCoach,” “we,” “us,” or “our”) operates the CineCoach platform at https://cinecoach.paris. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Service. We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the French Loi Informatique et Libertés, the California Consumer Privacy Act (CCPA), and other applicable privacy legislation.
The data controller for your personal data is:
Company: DECCS SAS
Address: 1B rue Stendhal, 75020 Paris, France
SIRET: 813 952 215 00016
Privacy Contact: info@cinecoach.paris
Note: We have designated a privacy contact person responsible for data protection matters. For the purposes of this policy, references to “Privacy Contact” mean the person or team reachable at the email address above.
Account information: name, email address, language preference, and account credentials.
User Content: screenplay excerpts, scripts, and other written materials you submit for feedback.
Communications: messages you send to us through support channels or feedback forms.
Payment information: billing details processed through Paddle (we do not store credit card numbers directly; Paddle acts as the Merchant of Record).
Usage data: pages visited, features used, session duration, and interaction patterns.
Device data: browser type, operating system, device type, and screen resolution.
Log data: IP address (anonymized after 30 days), access times, referring URLs, and error logs.
Cookie data: information collected through cookies and similar tracking technologies (see our Cookie Policy).
Payment data: transaction confirmations and billing status from Paddle (our Merchant of Record).
Authentication data: if you sign in via a third-party provider (e.g., Google), we receive basic profile information as authorized by you.
We process your personal data based on the following legal grounds:
Contract performance (Article 6(1)(b) GDPR): to provide the Service, process your Subscription, deliver feedback on your submissions, and manage your account.
Legitimate interests (Article 6(1)(f) GDPR): to improve the Service, ensure security, prevent fraud, and send you important service-related communications. Our legitimate interests do not override your fundamental rights and freedoms.
Consent (Article 6(1)(a) GDPR): for marketing communications, non-essential cookies, and any processing that requires your opt-in consent. You may withdraw your consent at any time (see Section 8).
Legal obligation (Article 6(1)(c) GDPR): to comply with tax, accounting, and other legal requirements under French and EU law.
To provide, maintain, and improve the Service, including Script Check, Explore, and Learn features.
To process your User Content and generate AI-powered screenplay feedback.
To manage your account and Subscription.
To process payments through Paddle (and in the future, Stripe).
To send you service-related communications (account confirmations, security alerts, updates).
To send marketing communications (only with your explicit prior consent; you may opt out at any time by clicking the unsubscribe link in any email or contacting us).
To analyze usage patterns in aggregated/anonymized form to improve the quality of the Service.
To detect, prevent, and address fraud, abuse, and security issues.
To comply with legal obligations and respond to lawful requests from authorities.
When you submit screenplay excerpts through Script Check or Learn modules, your User Content is processed by our AI system to generate personalized feedback. We want you to understand how this works:
Your User Content is processed by AI algorithms based on established cinematic methodology to produce educational feedback.
We do not use your User Content to train general-purpose AI models without your explicit, separate consent.
User Content is stored securely and associated with your account to enable features such as progress tracking in the Learn module.
AI processing involves transmitting your User Content to our AI service providers (such as OpenAI) under strict data processing agreements. These providers are contractually prohibited from using your data for any purpose other than providing the Service.
You may request deletion of your User Content at any time (see Section 8).
You have the right not to be subject to automated decision-making that produces legal or similarly significant effects on you (Article 22 GDPR). Our AI-generated feedback is educational guidance only and does not produce such effects.
We share data with trusted third-party service providers who assist us in operating the Service. Each operates under a data processing agreement:
Paddle.com Market Limited (United Kingdom) — payment processing, Merchant of Record. To be transitioned to Stripe, Inc.
AI service providers (e.g., OpenAI, Inc.) — for processing User Content and generating feedback.
Cloud hosting providers — for data storage and processing.
Analytics providers — for usage analysis and Service improvement.
Email service providers — for transactional and marketing communications.
An up-to-date list of our sub-processors is available upon request.
We may disclose your data if required by law, legal process, or governmental request, or if we believe disclosure is strictly necessary to protect our rights, your safety, or the safety of others.
In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of the transaction. We will notify you of any such change at least 30 days in advance and inform you of any choices you may have regarding your data.
We do not sell your personal data to third parties. We do not share your personal data for third-party advertising purposes. For CCPA purposes, we confirm that we have not sold personal information in the preceding 12 months.
Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States (for AI processing and hosting services). When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including:
Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Implementing Decision (EU) 2021/914).
Adequacy decisions by the European Commission for the destination country.
Supplementary measures where required by the EDPB guidelines.
You may request a copy of the safeguards in place by contacting us at info@cinecoach.paris.
Under the GDPR, you have the following rights:
Right of access (Article 15): obtain a copy of your personal data and information about how it is processed.
Right to rectification (Article 16): correct inaccurate or incomplete data.
Right to erasure (Article 17): request deletion of your personal data (“right to be forgotten”).
Right to restriction (Article 18): limit the processing of your data in certain circumstances.
Right to data portability (Article 20): receive your data in a structured, commonly used, machine-readable format (JSON or CSV).
Right to object (Article 21): object to processing based on legitimate interests or for direct marketing. Where you object to direct marketing, we will cease processing immediately.
Right to withdraw consent (Article 7(3)): withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Right not to be subject to automated decision-making (Article 22): you have the right to request human review of automated decisions that significantly affect you.
Right to lodge a complaint (Article 77): with your local data protection authority (in France: CNIL).
Under the CCPA/CPRA, California residents have the following rights:
Right to know: what personal information we collect, use, and disclose, and the categories of sources and third parties.
Right to delete: request deletion of personal information.
Right to correct: request correction of inaccurate personal information.
Right to opt-out: of the sale or sharing of personal information (we do not sell or share personal data).
Right to non-discrimination: for exercising your privacy rights.
To exercise any of these rights, please contact us at info@cinecoach.paris or by post at DECCS SAS, 1B rue Stendhal, 75020 Paris, France. We will acknowledge your request within 72 hours and respond substantively within 30 days (or the legally required timeframe in your jurisdiction). We may need to verify your identity before processing your request. If we cannot comply with your request, we will explain why.
We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy:
Account data: retained for the duration of your account plus 3 years after deletion (as required for potential legal claims under French law).
User Content: retained for the duration of your account; deleted within 30 days of a valid erasure request.
Payment records: retained for 10 years as required by French commercial and tax law (Code de commerce Article L123-22).
Usage and analytics data: anonymized within 13 months and retained in anonymized form for Service improvement.
Marketing consent records: retained for 3 years after last interaction or until consent is withdrawn.
IP addresses: anonymized within 30 days of collection.
We implement appropriate technical and organizational measures to protect your personal data in accordance with Article 32 of the GDPR, including:
Encryption of data in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
Access controls and role-based authentication mechanisms.
Regular security assessments, penetration testing, and monitoring.
Incident response procedures for data breaches.
Employee training on data protection and security.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 of the GDPR. We will also notify the CNIL within 72 hours of becoming aware of the breach (Article 33 GDPR).
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child under 16 has provided us with personal data, please contact us and we will take steps to delete such data within 30 days.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service, updating the ‘Last Updated’ date, and sending you an email notification at least 30 days before the changes take effect. We encourage you to review this Privacy Policy periodically.
For questions about this Privacy Policy or to exercise your privacy rights, please contact us at: info@cinecoach.paris.
You may also contact us by post at: DECCS SAS, 1B rue Stendhal, 75020 Paris, France.
If you are in the EU and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In France, this is the Commission Nationale de l’Informatique et des Libertés (CNIL): https://www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.